#!/bin/sh
cmd="/sbin/ipfw add"
/sbin/ipfw -qf flush

# Default
$cmd 001 pass all from any to any via lo0
$cmd 002 deny all from any to 127.0.0.0/8
$cmd 003 deny ip from 127.0.0.0/8 to any
$cmd 004 check-state

# Block Access (Torrent Trackers)
$cmd 005 deny ip from 83.140.176.0/24 to any via rl0
$cmd 005 deny ip from 69.64.61.0/24 to any via rl0
$cmd 005 deny ip from 208.66.69.0/24 to any via rl0
$cmd 005 deny ip from 66.7.197.0/24 to any via rl0
$cmd 005 deny ip from 83.149.102.0/24 to any via rl0
$cmd 005 deny ip from 69.64.61.0/24 to any via rl0
$cmd 005 deny ip from 202.9.98.0/24 to any via rl0
$cmd 005 deny ip from 82.192.86.0/24 to any via rl0
$cmd 005 deny ip from 66.228.124.0/24 to any via rl0
$cmd 005 deny ip from 83.227.1.0/24 to any via rl0
$cmd 005 deny ip from 85.17.0.0/16 to any via rl0
$cmd 005 deny ip from 193.138.231.0/24 to any via rl0
$cmd 005 deny ip from 193.138.230.0/24 to any via rl0
$cmd 005 deny ip from 83.149.90.0/24 to any via rl0
$cmd 005 deny ip from 209.44.123.0/24 to any via rl0
$cmd 005 deny ip from 217.13.206.0/24 to any via rl0
$cmd 005 deny ip from 219.153.20.0/24 to any via rl0

# Block Access (Abusive IP Ranges)
$cmd 006 deny ip from 58.61.0.0/16 to any 80 via rl0
$cmd 006 deny ip from 206.231.78.0/24 to any 80 via rl0
$cmd 006 deny ip from 66.154.102.0/24 to any 80 via rl0
$cmd 006 deny ip from 62.68.95.0/24 to any 80 via rl0
$cmd 006 deny ip from 203.144.0.0/16 to any 80 via rl0
$cmd 006 deny ip from 200.65.127.0/24 to any 80 via rl0
$cmd 006 deny ip from 58.49.251.0/24 to any 80 via rl0
$cmd 006 deny ip from 58.49.252.0/24 to any 80 via rl0
$cmd 006 deny ip from 196.205.0.0/16 to any 80 via rl0
$cmd 006 deny ip from 64.202.165.0/24 to any 80 via rl0
$cmd 006 deny ip from 85.15.0.0/16 to any 80 via rl0
$cmd 006 deny ip from 85.185.0.0/16 to any 80 via rl0
$cmd 006 deny ip from 64.39.129.0/24 to any 80 via rl0
$cmd 006 deny ip from 69.19.14.0/24 to any 80 via rl0

# Block Access (Abusive Search Engines)
$cmd 007 deny ip from 66.231.188.0/24 to any 80 via rl0
$cmd 007 deny ip from 69.19.14.0/24 to any 80 via rl0
$cmd 007 deny ip from 209.8.20.0/24 to any 80 via rl0

# Block SPAM Subnets
$cmd 010 deny ip from 85.96.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.246.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 81.214.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.233.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 85.104.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.241.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.240.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.248.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 85.108.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 85.98.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 81.215.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.226.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.242.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 85.102.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 88.238.0.0/16 to any 25 via rl0
$cmd 010 deny ip from 85.99.0.0/16 to any 25 via rl0

# Allow Ports
$cmd 100 pass all from any to any 21 keep-state
$cmd 101 pass tcp from any to any 25 keep-state
$cmd 102 pass tcp from any to any 37 keep-state
$cmd 103 pass all from any to any 43 keep-state
$cmd 104 pass tcp from any to any 52 keep-state
$cmd 105 pass all from any to any 53 keep-state
$cmd 106 pass tcp from any to any 80 keep-state
$cmd 107 pass tcp from any to any 110 keep-state
$cmd 108 pass tcp from any to any 143 keep-state
$cmd 109 pass tcp from any to any 443 keep-state
$cmd 110 pass tcp from any to any 465 keep-state
$cmd 111 pass tcp from any to any 783 keep-state
$cmd 112 pass tcp from any to any 873 keep-state
$cmd 113 pass tcp from any to any 993 keep-state
$cmd 114 pass tcp from any to any 995 keep-state

# Allow SSH Access
$cmd 200 allow ip from 24.222.0.0/16 to any 22 keep-state
$cmd 200 allow ip from 24.224.0.0/16 to any 22 keep-state

$cmd 220 deny tcp from any to any 22 keep-state

# Misc Settings
$cmd 300 pass tcp from any 20 to any 1024-65535 keep-state
$cmd 300 pass tcp from any to any 60000-65500 keep-state
$cmd 301 pass icmp from any to any icmptypes 8 keep-state
$cmd 302 allow ip from any to any uid root